This report is both disturbing and predictable. Proper credentials management is almost like the unicorn of IT security. Some people believe it actually exists, but rarely do you actually see it outside of books and magazines and sales presentations. For the record, it does exist. It can be accomplished. But it takes time and discipline and the resources to both make it happen and enforce the rules when it doesn’t.